Forced identification with automated POST resubmission

ABSTRACT

A method by a web application layer proxy communicatively coupled between a client and an origin server for performing automated POST resubmission. The method includes intercepting a request by the client for a resource provided by the origin server, obtaining an interstitial page in response to receiving an indication from a bot detector component that the client needs to be identified, where the interstitial page includes challenge code for interrogating the client and code for automatically submitting a form included in the interstitial page if the client successfully acquires a token, encrypting a payload of the request, adding the encrypted payload to a hidden input field of the form included in the interstitial page, and sending the interstitial page with the encrypted payload added to the hidden input field of the form to the client as a response to the request.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of U.S. Provisional Application No.62/704,206, filed Apr. 27, 2020, which is hereby incorporated byreference.

TECHNICAL FIELD

This disclosure relates to computer network security, and in particularto performing automated POST resubmission.

BACKGROUND

Automated web traffic is prevalent on the internet. The bots thatgenerate this traffic come from a wide variety of sources, from harmlessweb crawlers to malicious hackers targeting government voterregistration pages. It has been found that almost forty percent ofcollected internet traffic is generated by bots.

One way that websites, applications, and application programminginterfaces (APIs) attempt to defend against automated users withmalicious intent is through the use of a reverse proxy. A reverse proxysits “in front” of web servers and forwards requests from clients (e.g.web browsers) to those web servers. When a reverse proxy receives arequest for a web page from a client, the reverse proxy may send ananalysis request to a bot detector component to analyze the client'srequest. The bot detector component may analyze the client's request todetermine whether the client is operated by a bot or a human user andrespond to the request by returning a suggested action. If this is thefirst request that the bot detector component has seen from the clientthen the bot detector component may return an indication to the reverseproxy that the client needs to be identified (a “forced identification”action). In response, the reverse proxy may send an interstitial page tothe client that includes code for interrogating the client (e.g., whichmay involve fingerprinting the client (e.g., to uniquely identify theclient) and performing some challenges (e.g., to ensure that the clientis a real browser)). The client may execute the code which causes theclient to send the results of the interrogation to the bot detectorcomponent (e.g., via the reverse proxy). The bot detector component maydetermine, based on the results of the interrogation, whether the clientis operated by a bot. If the bot detector component determines that theclient is not operated by a bot, then the bot detector component maygenerate and send a token to the client (e.g., via the reverse proxy).Once the client acquires the token, the client may reload the web page.As before, when the reverse proxy receives the client's request it maysend an analysis request to the bot detector component to analyze theclient's request but this time the bot detector component may return anindication to the reverse proxy that the request is allowed to beforwarded to the origin server since the client has acquired a validtoken (and has been determined not to be operated by a bot). Inresponse, the reverse proxy may send the client's request to the originserver.

This technique works well with GET requests, as any data attached to theGET request is in the uniform resource locator (URL) itself and isresent when the page is reloaded after the client acquires the token.However, this technique may not work consistently with POST requestsbecause different types of clients (e.g., different types of webbrowsers) may handle reloads of POST requests differently. For example,some clients may display a pop-up dialog box asking the user if the userwishes to resubmit the POST data, which may be cumbersome for the user,while some clients may silently convert the POST request to a GETrequest, leading to loss of data.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a system in which automated POSTresubmission can be implemented, according to some embodiments.

FIG. 2 is a diagram illustrating interactions between the client, theweb application layer proxy, and the origin server, according to someembodiments.

FIG. 3 is a flow diagram of a process for performing automated POSTresubmission, according to some embodiments.

FIG. 4 is a block diagram illustrating an electronic device, accordingto some embodiments.

DETAILED DESCRIPTION

In the following description, numerous specific details such as logicimplementations, resource partitioning/sharing/duplicationimplementations, types and interrelationships of system components, andlogic partitioning/integration choices are set forth in order to providea more thorough understanding of the present invention. It will beappreciated, however, by one skilled in the art that the invention maybe practiced without such specific details. In other instances, controlstructures, gate level circuits and full software instruction sequenceshave not been shown in detail in order not to obscure the invention.Those of ordinary skill in the art, with the included descriptions, willbe able to implement appropriate functionality without undueexperimentation.

Bracketed text and blocks with dashed borders (e.g., large dashes, smalldashes, dot-dash, and dots) are used herein to illustrate optionaloperations that add additional features to embodiments of the invention.However, such notation should not be taken to mean that these are theonly options or optional operations, and/or that blocks with solidborders are not optional in certain embodiments of the invention.

References in the specification to “one embodiment,” “an embodiment,”“an example embodiment,” etc., indicate that the embodiment describedmay include a particular feature, structure, or characteristic, butevery embodiment may not necessarily include the particular feature,structure, or characteristic. Moreover, such phrases are not necessarilyreferring to the same embodiment. Further, when a particular feature,structure, or characteristic is described in connection with anembodiment, it is submitted that it is within the knowledge of oneskilled in the art to affect such feature, structure, or characteristicin connection with other embodiments whether or not explicitlydescribed.

In the following description and embodiments/claims, the terms “coupled”and “connected,” along with their derivatives, may be used. It should beunderstood that these terms are not intended as synonyms for each other.“Coupled” is used to indicate that two or more elements, which may ormay not be in direct physical or electrical contact with each other,co-operate or interact with each other. “Connected” is used to indicatethe establishment of communication between two or more elements that arecoupled with each other

As used herein, a network device (e.g., a router, switch, bridge) is anelectronic device that is a piece of networking equipment, includinghardware and software, which communicatively interconnects otherequipment on the network (e.g., other network devices, end stations).Some network devices are “multiple services network devices” thatprovide support for multiple networking functions (e.g., routing,bridging, and/or switching), and/or provide support for multipleapplication services (e.g., data, voice, and video).

As used herein, server end stations are network devices operable toexecute or otherwise implement one or more servers providing content orservices to clients. For example, server end stations may implement webapplication servers, application programming interface (API) servers,database servers, file servers, print servers, mail servers, gamingservers, application servers, and/or Domain Name System (DNS) servers.

As used herein, client end stations (e.g., workstations, laptops,netbooks, palm tops, mobile phones, smartphones, multimedia phones,Voice over Internet Protocol (VoIP) phones, user equipment (UE),terminals, portable media players, Global Positioning Satellite (GPS)units, gaming systems, set-top boxes) are network devices operable toexecute or otherwise implement applications that, among other functions,can access the content and/or services provided by servers over anetwork (e.g., over a local area network (LAN), over the internet,and/or over virtual private networks (VPNs) overlaid on (e.g., tunneledthrough) the internet).

As mentioned above, existing techniques for protecting websites,applications, and application programming interfaces (APIs) againstmalicious bots such as the one mentioned above may work well withHypertext Transfer Protocol (HTTP) GET requests, as any data attached tothe GET request is in the uniform resource locator (URL) itself and thusis resent when the page is reloaded after the client acquires the token.However, this technique may not work consistently with HTTP POSTrequests because different types of clients (e.g., different types ofweb browsers) may handle reloads of POST requests differently. Forexample, some clients may display a pop-up dialog box asking the user ifthe user wishes to resubmit the POST data, which may be cumbersome forthe user, while some clients may silently convert the POST request to aGET request, leading to loss of data.

Embodiments described herein allow bot detection to work consistentlyand securely for POST requests across different types of clients (e.g.,without displaying a pop-up dialog and/or without loss of data) byintroducing a technique that is referred to herein as “automated POSTresubmission” instead of relying on page reloads. An embodiment is amethod by a network device implementing a web application layer proxycommunicatively coupled between a client and an origin server. Themethod includes intercepting a request by the client for a resourceprovided by the origin server, where the request is a POST request,sending an analysis request to a bot detector component to analyze therequest in response to intercepting the request, generating aninterstitial page in response to receiving a response from the botdetector component indicating that the client needs to be identified,where the interstitial page includes challenge code for interrogatingthe client and code for automatically submitting a form included in theinterstitial page if the client successfully acquires a token,encrypting a payload of the request using an initialization vector and asecret key, adding the encrypted payload to a hidden input field of theform included in the interstitial page, and sending the interstitialpage with the encrypted payload added to the hidden input field of theform to the client as a response to the request, where the response issent with the initialization vector as a cookie. The method may furtherinclude receiving the encrypted payload from the client, where theencrypted payload is received from the client due to the clientsubmitting the form included in the interstitial page after acquiringthe token, decrypting the encrypted payload using the initializationvector and the secret key to recover the payload of the request,reconstructing the request using the recovered payload of the request,and sending the reconstructed request to the origin server. Variousembodiments are further described with reference to the accompanyingfigures.

FIG. 1 is a block diagram of a system in which automated POSTresubmission can be implemented, according to some embodiments. As shownin the diagram, the system includes a web application layer proxy 100that is communicatively coupled between a client 110 and an originserver 120. The client 110 may access a resource (e.g., a web page orAPI) hosted by the origin server 120, for example, by generating one ormore web application layer requests (e.g., HTTP request messages such asa “POST” HTTP request messages or “GET” HTTP request messages) andsending these web application layer requests to the origin server 120.In response to receiving web application layer requests, the originserver 120 may send corresponding web application layer responses (e.g.,HTTP response messages) containing data/content to the client 110. Theclient 110 may render the data/contents of the web application layerresponses (e.g., on a display screen for an end user) or otherwiseconsume the data/contents of the web application layer responses. Theclient 110 may be implemented using one or more client end station andthe origin server 120 may be implemented using one or more server endstations. In one embodiment, the client 110 is a web browser and theserver 120 is a web server. While for the sake of simplicity the diagramshows a single client 110 and a single origin server 120, it should beunderstood that there can be more than one client 110 accessing morethan one origin server 120.

As shown in the diagram, the web application layer proxy 100 is deployed“in front” of the origin server 120 to protect the origin server 120from attacks by clients (e.g., the client 110). In one embodiment, theweb application layer proxy 100 is a reverse proxy that sits inline tothe traffic being sent between the clients and the origin server 120such that it can see the traffic being sent to the origin server 120(and possibly see traffic being sent in the other direction by theorigin server 120 to the clients). In one embodiment, the webapplication layer proxy 100 implements a web application firewall, acontent delivery network (CDN) proxy, and/or a load balancer. The webapplication layer proxy 100 may be implemented using one or more networkdevices.

As shown in the diagram, the web application layer proxy 100 is alsocommunicatively coupled to a bot detector component 130. The botdetector component 130 may receive analysis requests from the webapplication layer proxy 100 to analyze client requests (e.g., webapplication layer requests sent by clients to the origin server 120)received by the web application layer proxy 100 with regard to whetherthe requests are generated by a bot or a human user. The bot detectorcomponent 130 may be implemented using one or more network devices.While the bot detector component 130 is shown in the diagram as beingimplemented separately from the web application layer proxy 100, in someembodiments the bot detector component 130 may be integrated within theweb application layer proxy 100. In one embodiment, the bot detectorcomponent 130 is owned/operated by an entity that is different from theentity that owns/operates the origin server 120 and/or the webapplication layer proxy 100. For example, the entity that owns/operatesthe bot detector component 130 may provide bot detection services to theentity that owns/operates the origin server 120 and/or the webapplication layer proxy 100. In this sense, the entity thatowns/operates the origin server 120 and/or the web application layerproxy 100 may be a customer of the entity that owns/operates the botdetector component 130.

Example operations for performing automated POST resubmission will nowbe described with reference being made to the system shown in FIG. 1.

At operation ‘1’ the client 110 sends a POST request to the originserver 120. At operation ‘2’ the web application layer proxy 100intercepts the client's request (before it reaches the origin server120) and sends an analysis request to the bot detector component 130 toanalyze the client's request (and possibly other information about theclient 110) to determine whether the client 110 is operated by a bot ora human user. The analysis request may include the client's requestitself, other information about the client's request, and/or informationbout the client itself. For example, the analysis request may includethe client's request itself (or a portion thereof), the client'sInternet Protocol (IP) address, a request ID (e.g., which may be an IDassigned to the client's request by the owner/operator of the originserver 120), information about a challenge-response test (e.g., atimestamp indicating when a challenge-response test such as a CAPTCHAwas solved for this client), information about recent origin serverresponses sent to the client 110, various statistics/metrics (e.g.,statistics about the requests and responses sent between the webapplication layer proxy 100 and the bot detector component 130 (e.g.,statistics about errors that occurred such as the number of recentanalysis requests to the bot detector component 130 that have timedout), statistics about the types of suggestions/actions (e.g., block orallow) returned for GET requests and POST requests, respectively, thelatency of analysis requests/responses to/from the bot detectorcomponent 130, etc.), and information about the web application layerproxy 120 that sent the analysis request (e.g., the ID of the webapplication layer proxy 120, the current software version being used bythe web application layer proxy 120, the type of web application layerproxy 120, the uptime of the web application layer proxy 120 (e.g., thenumber of seconds the web application layer proxy has been inoperation), etc.).

A simple example of an analysis request is provided below:

POST /v6/analysis HTTP/1.1 Authorization: BasicYXBpX2tleV9pZDphcGlfc2VjcmV0X2tleQ== Content-Type: application/jsonContent-Length: 445 Host: distilendpoint.example.com User-Agent: test {“client_ip”: “10.20.30.40”, “raw_request”:“R0VUIC8gSFRUUC8xLjENCkhvc3Q6IGF3cy1zbW9rZXRlc3Qtc3RhZ2luZy5kaXN0aWwubmluamENClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwLjEzOyBydjo2My4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzYzLjANCkFjY2VwdDogdGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksKi8qO3E9MC44DQpBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTLGVuO3E9MC41DQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUNCg0K” }

At operation ‘3’ the bot detector component 130 analyzes the client'srequest and sends a response to the web application layer proxy 100indicating that the client needs to be identified/interrogated (e.g.,because the request does not include a valid token—this could be becausethis is the first time the client 110 is accessing the origin server 120or because the client's existing token has expired).

A simple example of a response to the analysis request is providedbelow:

HTTP/1.1 200 OK Server: openresty/1.14.0.0 Date: Fri, 08 Feb 201916:08:12 GMT Content-Type: application/json Content-Length: 157Connection: keep-alive access-control-allow-origin: * server-timing:bon, total;dur=1.553252 {  “action”: “monitor”,  “fingerprint”:“9c81f392-8448-46b8-8c0d-210958698704”,  “flags”: [ “no_token”  ], “tags”: [  “automated_browsers”  ] }

At operation ‘4’ the web application layer proxy 100 obtains/generatesan interstitial page, where the interstitial page includes a form with ahidden input field. At operation ‘5’ the web application layer proxy 100encrypts the POST data included in the client's POST request and adds itto the hidden input field of the form included in the interstitial page.The web application layer proxy 100 may encrypt the POST data using aninitialization vector (IV) and a secret key. The web application layerproxy 100 may randomly (or pseudo-randomly) generate the IV each time itperforms encryption such that encrypting the same message twice wouldyield two completely different ciphertexts, which allows the encryptionscheme to be semantically secure. In one embodiment, the web applicationlayer proxy 100 encrypts the POST data using Advanced EncryptionStandard (AES) 256 (e.g., AES Cipher Blocker Chaining) or a similarencryption mechanism. At operation ‘6’ the web application layer proxy100 sends the interstitial page and the IV used to encrypt the POST datato the client 110. In one embodiment, the IV is sent as a cookie.

At operation ‘7’ the client 110 loads the interstitial page and executeschallenge code included therein to interrogate the client 110. Theinterrogation may involve, for example, fingerprinting the client touniquely identify it, as well as performing some challenges (e.g., toensure that the client is a real browser). While in some embodiments,the actual challenge code is embedded in the interstitial page itself,in other embodiments the challenge code is stored remotely and theinterstitial page includes a reference/link to the remotely storedchallenge code (e.g., using a <SCRIPT src=URL of challenge code>HTMLtag). In one embodiment, the challenge code is stored at the botdetector component 130. In this case, the client 110 may send a requestto the bot detector component 130 for the challenge code (e.g.,indirectly via the web application layer proxy 100 or directly to thebot detector component 130).

If the bot detector component 130 determines that the client 110 is notoperated by a bot, then it may generate and provide a token for theclient 110. In this example, it is assumed that the bot detectorcomponent 130 determines that the client 110 is not operated by a botand thus generates and provides a token for the client 110 (e.g., thebot detector component 130 may send the token to the client 110 as acookie). At operation ‘8’ the client 110 acquires the token and submitsthe form with the hidden input field, where the form submission includesthe encrypted POST data (since it was previously added to the hiddeninput field of the form by the web application layer proxy 100 atoperation ‘5’). The IV and the acquired token may also be sent alongwith the form submission (e.g., as cookies). It should be noted thatsending the IV is not necessary (i.e., it is optional) but it mayprovide extra safety in the case that the interstitial page gets cachedby a proxy somewhere (e.g., because that proxy does not adhere to cachedirectives/policies) and served to another client. With the IV, if adifferent client submits the same form using a cached version of theinterstitial page, the web application layer proxy 100 can determinethat the submission is invalid if the submission does not include thecorrect IV to decrypt the POST data. It should also be noted that thesecret key that was used to encrypt the POST data may be kept secret andnot shared outside of the web application layer proxy 100.

At operation ‘9’ the web application layer proxy 100 intercepts the formsubmission and identifies the form submission as being a POSTresubmission (e.g., based on the existence of the hidden input field inthe form). In response, the web application layer proxy 100 may send ananalysis request to the bot detector component 130 to analyze theclient's request (i.e., the form submission). This time, the botdetector component 130 may send a response to the web application layerproxy 100 indicating that the client 110 is not operated by a botbecause the client 110 has acquired a valid token. In response, atoperation ‘10’ the web application layer proxy 100 decrypts theencrypted POST data (e.g., using the IV and the secret key). Atoperation ‘11’ the web application layer proxy 100 reconstructs theclient's original request using the decrypted POST data and at operation‘12’ sends the client's reconstructed request to the origin server 120.It should be noted that in this example the bot detector component 130determined that the client 110 is not operated by a bot because theclient has acquired a valid token. If the bot detector component 130 hadinstead determined that the client 110 is operated by a bot then it mayhave instead sent a response to the web application layer proxy 100indicating that the client should be blocked (or that the webapplication layer proxy 100 should take some other action to restrictaccess of the client 110 or should further verify the client'slegitimacy) and the web application layer proxy 100 may have sent acorresponding response to the client 110 (e.g., a response indicatingthat access is unauthorized (e.g. a 401 unauthorized page)).

At operation ‘13’ the origin server 120 receives the reconstructedrequest and at operation ‘14’ generates and sends a response to thereconstructed request to the client 110. At operation ‘15’ the clientreceives and processes the response.

As a result of these operations, the client 110 is able to seamlesslyreceive a response to its original POST request if the bot detectorcomponent 130 determines that the client 110 is not operated by a bot.The operations may be transparent to the user of the client 110 in thatthe user may not even be aware of the interstitial page and theinterrogation being performed on the client 110. Since embodimentsperform a POST resubmit instead of relying on performing a page reload,they work consistently across different types of clients even if thoseclients handle page reloads for POST requests differently. Also,embodiments may send/receive the POST data (which may includepotentially sensitive information (e.g., login credentials, credit cardnumbers, etc.)) to/from the client 110 in encrypted form without havingto store the POST data at the web application layer proxy 100 (at leastnot in any permanent way) and/or without sending the POST data to thebot detector component 130, which helps safeguard information (e.g.,sending the POST data to the bot detector component 130 may beundesirable particularly if the bot detector component 130 isowned/operated by a different entity from the entity that owns/operatesthe origin server 120 and/or the web application layer proxy 100).

FIG. 2 is a diagram illustrating interactions between the client, theweb application layer proxy, and the origin server, according to someembodiments. As shown in the diagram, the client 110 sends a POSTrequest to the origin server 120 for the web page “/index.html.” The webapplication layer proxy 100 intercepts the client's request and sends aPOST request (an analysis request) to the “/analysis” endpoint of thebot detector component 130. The bot detector component 130 analyzes theclient's request to determine whether the client is operated by a bot.In this example the bot detector 130 determines that the client 110needs to be identified because it has not acquired a valid token. Thus,the bot detector component 130 sends a response to the web applicationlayer proxy 100 indicating that the client 110 needs to be identified.The web application layer proxy 100 generates/obtains an interstitialpage, encrypts the payload of the client's request (e.g., the POST dataincluded in the client's request) using an IV and a secret key, adds theencrypted payload to a hidden input field of a form included in theinterstitial page, and sends the interstitial page to the client 110along with the IV used to encrypt the payload of the client's request asa cookie. The interstitial page includes challenge code forinterrogating the client 110 (e.g., via a <SCRIPT src=URL of challengecode> HTML tag) and code for submitting the form with the hidden in putfield if the client successfully acquires a token. The client 110 loadsthe interstitial page and sends a GET request to the “/obfuscated”endpoint of the web application layer proxy 100 for the challenge code(it should be noted that “/obfuscated” and the other endpoint names usedin this example are merely examples and that in practicalimplementations it may be desirable to use endpoint names that do nothint at the functionality behind the endpoints to improve security). Inresponse, the web application layer proxy 100 sends a GET request to the“/challenge” endpoint of the bot detector component 130 for thechallenge code. In response, the bot detector component 130 sends thechallenge code to the web application layer proxy 100, which in turnsends the challenge code to the client 110. The client 110 executes thechallenge code, which involves interrogating the client 110. The client110 then sends a POST request to the “/obfuscated” endpoint of the webapplication layer proxy 100 that includes the results of theinterrogation. The web application layer proxy 100 sends the results ofthe interrogation to the “/challenge” endpoint of the bot detectorcomponent 130 for analysis. The bot detector component 130 then analyzesthe results of the interrogation and generates and provides a token forthe client 110 if it determines that the client 110 is not operated by abot. In this example, the bot detector component 130 determines that theclient 110 is not operated by a bot and thus generates a token for theclient 110 and sends the token to the web application layer proxy 100,which in turn sends the token to the client 110. The client 110 storesthe token as a cookie and submits the form with the hidden input field.This results in a POST request along with the IV and the token beingsent to the origin server 120. The web application layer proxy 100intercepts this request and sends a POST request to the “/analysis”endpoint of the bot detector component 130 to analyze the client'srequest. This time the bot detector component 130 determines that theclient 110 is not operated by a bot because it has acquired a validtoken, and thus is allowed to access the origin server 120. Thus, thebot detector component 130 sends a response to the web application layerproxy 100 indicating that the client 110 is not operated by a bot and isallowed access the origin server 120. In response, the web applicationlayer proxy 100 decrypts the payload using the IV and the secret key andreconstructs the original request using the decrypted payload. The webapplication layer proxy 100 then sends the reconstructed request to theorigin server 120. The origin server 120 then generates and sends aresponse to the reconstructed request to the client 110.

FIG. 3 is a flow diagram of a process for performing automated POSTresubmission, according to some embodiments. In one embodiment, theprocess is implemented by a network device implementing a webapplication layer proxy that is communicatively coupled between a clientand an origin server. The web application layer proxy may be, forexample, a content distribution network (CDN) proxy, a web applicationfirewall (or other type of network security device), and/or a loadbalancer. The process may be implemented using hardware, software,firmware, or any combination thereof.

The operations in the flow diagram are described with reference to theexemplary embodiments of the other diagrams. However, it should beunderstood that the operations of the flow diagram can be performed byembodiments of the invention other than those discussed with referenceto these other diagrams, and the embodiments of the invention discussedwith reference these other diagrams can perform operations differentthan those discussed with reference to the flow diagram.

Similarly, while the flow diagram shows a particular order of operationsperformed by certain embodiments, it should be understood that suchorder is provided by way of example only (e.g., alternative embodimentsmay perform the operations in a different order, combine certainoperations, overlap certain operations, etc.).

At block 305, the web application layer proxy intercepts a request bythe client for a resource (e.g., a web page) provided by the originserver, where the request is an HTTP POST request (as opposed to an HTTPGET request).

At block 310, the web application layer proxy sends an analysis requestto a bot detector component to analyze the request in response tointercepting the request.

At block 315, the web application layer proxy generates/obtains aninterstitial page in response to receiving a response from the botdetector component indicating that the client needs to be identified,where the interstitial page includes challenge code for interrogatingthe client and code for automatically submitting a form included in theinterstitial page if the client successfully acquires a token. In oneembodiment, the bot detector component determines that the client needsto be identified because the client has not acquired a valid token. Inone embodiment, the challenge code is included in the interstitial pageusing a script tag (e.g., HTML “<SCRIPT>” tag) that references a(remote) location (e.g., URL) of the challenge code. In one embodiment,the challenge code includes code for obtaining information about theclient (e.g., which fonts are installed) and sending the informationabout the client to the bot detector component for analysis.

At block 320, the web application layer proxy encrypts a payload of therequest (e.g., POST data) using an initialization vector (e.g., which isgenerated randomly or pseudo-randomly) and a secret key. In oneembodiment, the payload is encrypted using AES 256.

At block 325, the web application layer proxy adds the encrypted payloadto a hidden input field of the form included in the interstitial page.In one embodiment, the payload of the request is encrypted and added tothe hidden input field of the form included in the interstitial page inresponse to a determination by the web application layer proxy that therequest is a POST request as opposed to a GET request.

At block 330, the web application layer proxy sends the interstitialpage with the encrypted payload added to the hidden input field of theform to the client as a response to the request, where the interstitialpage is sent with the initialization vector (that was used to encryptthe payload) as a cookie.

In one embodiment, at block 335, the web application layer proxyreceives the encrypted payload (e.g., along with the initializationvector and token as cookies), where the encrypted payload is receivedfrom the client due to the client submitting the form included in theinterstitial page after acquiring the token.

In one embodiment, at block 340, the web application layer proxydecrypts the encrypted payload using the initialization vector and thesecret key to recover the (original) payload of the request.

In one embodiment, at block 345, the web application layer proxyreconstructs the request using the recovered payload of the request.

In one embodiment, at block 350, the web application layer proxy sendsthe reconstructed request to the origin server.

In one embodiment, the web application layer proxy intercepts a furtherrequest by the client for a resource provided by the origin server,where the further request is sent with the token as a cookie. The webapplication layer proxy then sends a further analysis request to the botdetector component to analyze the further request in response tointercepting the further request. The web application layer proxy sendsthe further request to the origin server in response to receiving aresponse from the bot detector component that the client is not operatedby a bot, where the bot detector determines that the client is notoperated by a bot based on a determination that the token acquired bythe client is valid.

FIG. 4 is a block diagram illustrating an electronic device, accordingto some embodiments. FIG. 4 illustrates hardware 420 comprising a set ofone or more processor(s) 422, a set of one or more network interfaces424 (wireless and/or wired), and non-transitory machine-readable storagemedium/media 426 having stored therein software 428 (which includesinstructions executable by the set of one or more processor(s) 422).Software 428 can include code, which when executed by hardware 420,causes the electronic device 400 to perform operations of one or moreembodiments described herein (e.g., operations for forcingidentification).

In electronic devices that use compute virtualization, the set of one ormore processor(s) 422 typically execute software to instantiate avirtualization layer 408 and software container(s) 404A-R (e.g., withoperating system-level virtualization, the virtualization layer 408represents the kernel of an operating system (or a shim executing on abase operating system) that allows for the creation of multiple softwarecontainers 404A-R (representing separate user space instances and alsocalled virtualization engines, virtual private servers, or jails) thatmay each be used to execute a set of one or more applications; with fullvirtualization, the virtualization layer 408 represents a hypervisor(sometimes referred to as a virtual machine monitor (VMM)) or ahypervisor executing on top of a host operating system, and the softwarecontainers 404A-R each represent a tightly isolated form of a softwarecontainer called a virtual machine that is run by the hypervisor and mayinclude a guest operating system; with para-virtualization, an operatingsystem or application running with a virtual machine may be aware of thepresence of virtualization for optimization purposes). Again, inelectronic devices where compute virtualization is used, duringoperation an instance of the software 428 (illustrated as instance 406A)is executed within the software container 404A on the virtualizationlayer 408. In electronic devices where compute virtualization is notused, the instance 406A on top of a host operating system is executed onthe “bare metal” electronic device 400. The instantiation of theinstance 406A, as well as the virtualization layer 408 and softwarecontainers 404A-R if implemented, are collectively referred to assoftware instance(s) 402.

Alternative implementations of an electronic device may have numerousvariations from that described above. For example, customized hardwareand/or accelerators might also be used in an electronic device.

The techniques shown in the figures can be implemented using code anddata stored and executed on one or more electronic devices (e.g., an endstation, a network device). Such electronic devices, which are alsoreferred to as computing devices, store and communicate (internallyand/or with other electronic devices over a network) code and data usingcomputer-readable media, such as non-transitory machine-readable storagemedia (e.g., magnetic disks, optical disks, random access memory (RAM),read-only memory (ROM); flash memory, phase-change memory) andtransitory computer-readable communication media (e.g., electrical,optical, acoustical or other form of propagated signals, such as carrierwaves, infrared signals, digital signals). In addition, electronicdevices include hardware, such as a set of one or more processorscoupled to one or more other components, e.g., one or morenon-transitory machine-readable storage media to store code and/or data,and a set of one or more wired or wireless network interfaces allowingthe electronic device to transmit data to and receive data from othercomputing devices, typically across one or more networks (e.g., LocalArea Networks (LANs), the Internet). The coupling of the set ofprocessors and other components is typically through one or moreinterconnects within the electronic device, (e.g., busses, bridges).Thus, the non-transitory machine-readable storage media of a givenelectronic device typically stores code (i.e., instructions) forexecution on the set of one or more processors of that electronicdevice. Of course, various parts of the various embodiments presentedherein can be implemented using different combinations of software,firmware, and/or hardware. As used herein, a network device (e.g., arouter, switch, bridge) is an electronic device that is a piece ofnetworking equipment, including hardware and software, whichcommunicatively interconnects other equipment on the network (e.g.,other network devices, end stations). Some network devices are “multipleservices network devices” that provide support for multiple networkingfunctions (e.g., routing, bridging, switching), and/or provide supportfor multiple application services (e.g., data, voice, and video).

While the invention has been described in terms of several embodiments,those skilled in the art will recognize that the invention is notlimited to the embodiments described, can be practiced with modificationand alteration within the spirit and scope of the appendedembodiments/claims. The description is thus to be regarded asillustrative instead of limiting.

What is claimed is:
 1. A method by a network device implementing a webapplication layer proxy communicatively coupled between a client and anorigin server for performing automated POST resubmission, the methodcomprising: intercepting a request by the client for a resource providedby the origin server, wherein the request is a POST request; sending ananalysis request to a bot detector component to analyze the request inresponse to intercepting the request; obtain an interstitial page inresponse to receiving a response from the bot detector componentindicating that the client needs to be identified, wherein theinterstitial page includes challenge code for interrogating the clientand code for automatically submitting a form included in theinterstitial page if the client successfully acquires a token;encrypting a payload of the request using an initialization vector and asecret key; adding the encrypted payload to a hidden input field of theform included in the interstitial page; and sending the interstitialpage with the encrypted payload added to the hidden input field of theform to the client as a response to the request, wherein theinterstitial page is sent with the initialization vector as a cookie. 2.The method of claim 1, further comprising: receiving the encryptedpayload from the client, wherein the encrypted payload is received fromthe client due to the client submitting the form included in theinterstitial page after acquiring the token; decrypting the encryptedpayload using the initialization vector and the secret key to recoverthe payload of the request; reconstructing the request using therecovered payload of the request; and sending the reconstructed requestto the origin server.
 3. The method of claim 2, further comprising:receiving the initialization vector from the client as a cookie alongwith the encrypted payload.
 4. The method of claim 1, wherein thepayload is encrypted using Advanced Encryption Standard (AES)
 256. 5.The method of claim 1, wherein the challenge code includes code forobtaining information about the client and sending the information aboutthe client to the bot detector component for analysis.
 6. The method ofclaim 1, further comprising: intercepting a further request by theclient for a resource provided by the origin server, wherein the furtherrequest is sent with the token as a cookie; sending a further analysisrequest to the bot detector component to analyze the further request inresponse to intercepting the further request; and forwarding the furtherrequest to the origin server in response to receiving a response fromthe bot detector component that the client is not operated by a bot,wherein the bot detector determines that the client is not operated by abot based on a determination that the token acquired by the client isvalid.
 7. The method of claim 1, wherein the payload of the request isencrypted and added to the hidden input field of the form included inthe interstitial page in response to a determination by the webapplication layer proxy that the request is a POST request as opposed toa GET request.
 8. The method of claim 1, wherein the bot detectorcomponent determines that the client needs to be identified because theclient has not acquired a valid token.
 9. The method of claim 1, whereinthe web application layer proxy is a content distribution network (CDN)proxy, a web application firewall, or a load balancer.
 10. The method ofclaim 1, wherein the challenge code is included in the interstitial pageusing a script tag that references a location of the challenge code. 11.A network device configured to implement a web application layer proxythat is to be communicatively coupled between a client and an originserver to perform automated POST resubmission, the network devicecomprising: one or more processors; and a non-transitorymachine-readable storage medium having instructions stored therein,which when executed by the one or more processors, causes the networkdevice to: intercept a request by the client for a resource provided bythe origin server, wherein the request is a POST request, send ananalysis request to a bot detector component to analyze the request inresponse to intercepting the request, obtain an interstitial page inresponse to receiving a response from the bot detector componentindicating that the client needs to be identified, wherein theinterstitial page includes challenge code for interrogating the clientand code for automatically submitting a form included in theinterstitial page if the client successfully acquires a token, encrypt apayload of the request using an initialization vector and a secret key,add the encrypted payload to a hidden input field of the form includedin the interstitial page, and send the interstitial page with theencrypted payload added to the hidden input field of the form to theclient as a response to the request, wherein the interstitial page issent with the initialization vector as a cookie.
 12. The network deviceof claim 11, wherein the instructions, when executed by the one or moreprocessors, further causes the network device to: receive the encryptedpayload from the client, wherein the encrypted payload is received fromthe client due to the client submitting the form included in theinterstitial page after acquiring the token, decrypt the encryptedpayload using the initialization vector and the secret key to recoverthe payload of the request, reconstruct the request using the recoveredpayload of the request, and send the reconstructed request to the originserver.
 13. The network device of claim 12, wherein the instructions,when executed by the one or more processors, further causes the networkdevice to: receiving the initialization vector from the client as acookie along with the encrypted payload.
 14. The network device of claim11, wherein the payload is encrypted using Advanced Encryption Standard(AES)
 256. 15. The network device of claim 11, wherein the challengecode includes code for obtaining information about the client andsending the information about the client to the bot detector componentfor analysis.
 16. A non-transitory machine-readable storage medium thatprovides instructions that, if executed by a processor of a networkdevice implementing a web application layer proxy that iscommunicatively coupled between a client and an origin server, causesthe network device to perform operations comprising: intercepting arequest by the client for a resource provided by the origin server,wherein the request is a POST request; sending an analysis request to abot detector component to analyze the request in response tointercepting the request; generating an interstitial page in response toreceiving a response from the bot detector component indicating that theclient needs to be identified, wherein the interstitial page includeschallenge code for interrogating the client and code for automaticallysubmitting a form included in the interstitial page if the clientsuccessfully acquires a token; encrypting a payload of the request usingan initialization vector and a secret key; adding the encrypted payloadto a hidden input field of the form included in the interstitial page;and sending the interstitial page with the encrypted payload added tothe hidden input field of the form to the client as a response to therequest, wherein the interstitial page is sent with the initializationvector as a cookie.
 17. The non-transitory machine-readable storagemedium of claim 16, wherein the operations further comprise: receivingthe encrypted payload from the client, wherein the encrypted payload isreceived from the client due to the client submitting the form includedin the interstitial page after acquiring the token; decrypting theencrypted payload using the initialization vector and the secret key torecover the payload of the request; reconstructing the request using therecovered payload of the request; and sending the reconstructed requestto the origin server.
 18. The non-transitory machine-readable storagemedium of claim 17, wherein the operations further comprise: receivingthe initialization vector from the client as a cookie along with theencrypted payload.
 19. The non-transitory machine-readable storagemedium of claim 16, wherein the operations further comprise:intercepting a further request by the client for a resource provided bythe origin server, wherein the further request is sent with the token asa cookie; sending a further analysis request to the bot detectorcomponent to analyze the further request in response to intercepting thefurther request; and forwarding the further request to the origin serverin response to receiving a response from the bot detector component thatthe client is not operated by a bot, wherein the bot detector determinesthat the client is not operated by a bot based on a determination thatthe token acquired by the client is valid.
 20. The non-transitorymachine-readable storage medium of claim 16, wherein the payload of therequest is encrypted and added to the hidden input field of the formincluded in the interstitial page in response to a determination by theweb application layer proxy that the request is a POST request asopposed to a GET request.